Dear Liju Varghese, I have a File Server (Windows Server 2008 R2) in domain environment (AD is Windows Server 2008 R2). Tristan, thanks for the script. It needs adjustment if you want to examine archived files (retain old events). And I added the accessmask-descriptions as a hash table.

Apart from that I wanted to underline the importancy of confining the audit group to as little as possible. Never use generic groups like authenticated users or domain administrators. Even without the backup my security log gets cluttered from the indexing engine! Speedway Series 125 Amp Flux Welder Manual.

So really define a group – say ‘AuditedUsers’ – and put only necessary users in it. Hi Kington – thanks for the script, but it is not working for me, giving me this below error! How To Install Arcgis 10.1 Crack.

Please help me thanks in advance! Select-Xml: ‘//e:data[@Name=’SubjectUserName’]/text()’ has an invalid token. At line:12 char:28 + $SubjectUserName = Select-Xml -Xml $xml -Namespace $ns -XPath “//e:data[ + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo: NotSpecified: (:) [Select-Xml], XPathException + FullyQualifiedErrorId: System.Xml.XPath.XPathException,Microsoft.PowerShell.Commands.SelectXmlCommand Select-Xml: ‘//e:Data[@Name=’ObjectName’]/text()’ has an invalid token. At line:14 char:23 + $ObjectName = Select-Xml -Xml $xml -Namespace $ns -XPath “//e:Data[@Name + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo: NotSpecified: (:) [Select-Xml], XPathException + FullyQualifiedErrorId: System.Xml.XPath.XPathException,Microsoft.PowerShell.Commands.SelectXmlCommand Select-Xml: ‘//e:Data[@Name=’AccessMask’]/text()’ has an invalid token. At line:16 char:23 + $AccessMask = Select-Xml -Xml $xml -Namespace $ns -XPath “//e:Data[@Name + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo: NotSpecified: (:) [Select-Xml], XPathException + FullyQualifiedErrorId: System.Xml.XPath.XPathException,Microsoft.PowerShell.Commands.SelectXmlCommand. Hi Kington, the code is showing below error please help me (my file server is 2012 R2) Get-WinEvent: Could not retrieve information about the Security log. Error: Attempted to perform an unauthorized operation.